Privacy policy

Data controller

The controller of personal data is CAR & GO Sp. z o.o., Wiejska 12/3, 00-490 Warsaw, VAT ID PL7011315538.

For anything concerning personal data write to info@carngo.eu or call 798 711 580. We have not appointed a data protection officer, as we are not required to.

What we collect

• Data from the contact form and from car enquiries: name, e-mail address or phone number, and the message together with the dates and the car you picked and, in the insurance calculator, the number of drivers, the driver's age range (the year of birth in older enquiries) and whether you plan to drive abroad
• Data from the download form on the blog: e-mail address, the name of the material you downloaded, whether you agree to be contacted about a rental and, if you do, optionally a phone number
• Data from the booking form: full name, e-mail address, phone number, dates, hand-over times and place, notes, and the driver's year of birth when the booking includes rental insurance or a car with a minimum driver age
• Booking draft: if you tick the consent to a phone call in the booking form, we save your full name, e-mail address, phone number, car and dates as you type, before you send the form. If you click “I’d rather not fill this in, call me”, we save the same data as a request for a call. As with a booking or an enquiry, we also record where the visit came from (channel, campaign, landing page and, with your analytics consent, your first contact in the last 30 days) and the type of device (computer, phone or tablet)
• Data from e-mail and phone conversations, where you give it to us yourself
• Technical data recorded by the server in the access logs: IP address, date and time of the request, browser type
• Data needed to conclude and settle the rental contract, collected off the site: ID card and driving licence details, invoicing details
• Data from the GPS tracker fitted in every car of ours: location, speed, mileage, ignition status, g-forces from the motion sensor (hard braking, impact) and the car's technical condition (battery voltage, fuel level, dashboard warning lights), recorded during the rental and outside it
• Data for online payments: full name, e-mail address, phone number, amount and booking reference, which we pass to the payment operator. We do not receive card or bank account details, because you enter them directly with the operator

Why, and on what legal basis

How long we keep it

• Enquiries that did not lead to a contract and downloads from the blog: up to a year from the last contact; consent to be contacted about a rental lasts until you withdraw it
• Booking draft: 30 days from the last change; we delete it as soon as you send the booking. A request for a call: like other enquiries, up to a year from the last contact
• Rental contract data: for the term of the contract and until claims are time-barred
• Invoices and accounting records: five years from the end of the tax year, as the law requires
• Server logs: no longer than twelve months
• GPS tracker routes: 365 days from recording, and tracker events (e.g. leaving the country) one year; longer only when needed to establish, pursue or defend claims
• Statistics in Google Analytics 4: fourteen months
• Our own site statistics: detailed events for 90 days, then daily totals only, kept for two years

Who processes it for us

We do not sell data and do not share it for marketing. We entrust it only to those who work for us and on our terms:

• The hosting provider running the site and the mailbox: [TO BE COMPLETED: hosting provider name and address]
• The vehicle tracking system providers: the operators of the TruckOnline and Flotman (Flotman Sp. z o.o.) platforms that run the GPS trackers in our cars
• The online payment operator, when you pay while booking: Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland
• Our accountants, for accounting records
• The insurer and the assistance company, in case of damage
• Public authorities, where the law requires it

GPS tracker in the car

Every car of ours has a GPS tracker that records its location, speed, mileage and ignition status, as well as g-forces from the motion sensor (hard braking, impact) and the car's technical condition: battery voltage, fuel level and dashboard warning lights. We tell you about it in the Rental Regulations and in the rental agreement before you get the car.

We use this data for four things only: protecting the car against theft, recording the mileage at hand-over and return, helping after a breakdown or accident, and pursuing claims under the contract. The office is notified when the car leaves the country or the agreed zone, is driven well above the speed limit, is started at night or is towed, when the motion sensor records g-forces that suggest a collision, and when the battery is flat or the tracker loses power or signal.

Tracker data is visible only to office staff with access to the fleet panel. We do not use it for marketing or profiling and do not share it with anyone except the tracking system provider and public authorities where the law requires it.

You have the right to object to this processing (Art. 21 GDPR) by writing to info@carngo.eu.

Cookies

Essential cookies remember the chosen language and your decision in the consent banner (the carngo_consent cookie, valid for 12 months). These cannot be switched off, because the page will not work properly without them. We set the cg_internal cookie (a fixed value of 1 with no identifier, valid for 12 months) in our staff’s browsers (after logging in to the admin panel or via a special link), so that our own visits are left out of the statistics.

The booking form remembers what you type in the memory of this browser tab (sessionStorage), so that it is not lost when you reload the page. It disappears when you close the tab and when you send the booking. It does not reach us until you tick the consent to a phone call or send the form.

Analytics (Google Analytics 4) and marketing cookies are set only with the consent you give in the banner. Until you do, the Google Analytics script sends only cookieless signals without browser identifiers (Google consent mode), which do not allow a visitor to be recognised. Google marketing cookies (_gcl_*) measure ad effectiveness; the provider is Google Ireland Limited and they are valid for up to 90 days.

You can change or withdraw consent at any time with the “Cookie settings” link in the footer. Withdrawal does not affect the lawfulness of processing before it.

The map on the contact page loads only after you click it, so that your browser does not reach an external service without your decision.

Google Analytics 4

With your consent we use Google Analytics 4, a visit statistics tool. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics sets the _ga and _ga_* cookies, which tell visits and browsers apart. They are valid for up to two years unless you delete them earlier or withdraw consent (we then delete them ourselves).

The purpose is purely statistical: which pages and cars are viewed, where visitors come from and whether the forms work. We never send your name, phone number, e-mail address, year of birth or message content to Google Analytics.

If you book with analytics cookies enabled, we store the browser identifier from the _ga cookie (and the visit identifier from the _ga_* cookie) with the booking. It is used for a single event: once we confirm the booking, our server reports the purchase to Google Analytics with that identifier: the internal booking ID, the amount, the car model and the number of days, without your contact details or booking number (and, if a confirmed booking is cancelled, a refund notice without the browser identifier). We delete the identifier as soon as this is sent, when the booking is cancelled, and at the latest after 30 days. Withdrawing consent in the banner applies to your browser and does not cover the identifier already stored with the booking. If you want us to delete it sooner, write to us (contact details at the top of this policy) and we will delete it, and no purchase report will be sent. A booking made without consent stores no identifier and sends nothing of the kind.

We keep Google Analytics data for fourteen months. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the “Cookie settings” link in the footer.

Google may also process data in the United States. Google LLC takes part in the EU-U.S. Data Privacy Framework, covered by a European Commission adequacy decision.

Car & Go's own statistics

On our own server, without any outside company, we count how visitors move through the site towards a booking or an enquiry: visits, cars viewed, choosing dates, seeing the price, starting and sending a form, clicks on the phone number and e-mail, and the pages from which visitors leave the site. We do it to improve the site and to know which sources (search engine, OLX, Facebook) bring customers. We never store your name, phone number, e-mail address or what you type into fields; when a form shows an error we store only the field name and the kind of error. We do not store your IP address: the server holds it in memory for a few minutes at most, only to limit the number of requests. For the daily request limit the server keeps in memory only a hash of it made with a random key that is replaced at midnight and never saved anywhere. From then on the hash cannot be linked to any address.

Without your consent in the “Analytics” category nothing is stored in your browser and events are counted only in aggregate. With consent we store a random visit ID in the tab's storage (it expires after 30 minutes of inactivity and when the tab is closed) and the source of the current visit, and in the browser's storage the source of your first visit (for 30 days from it) and of your latest one (for 30 days from your last visit; it helps when you open the site in a new tab), plus a random visitor ID (for 30 days from your last visit). The visitor ID lets us see the path the same browser took through the site across visits, so that we can improve the site; we do not link it to a booking, an enquiry or contact details, it is not derived from your IP address or device characteristics, and without consent it does not exist. After that we stop using them and delete them on your next visit. Rejecting or withdrawing consent removes all five. With a booking or an enquiry we store where the visit came from (and, with your consent, the source, page and day of your first visit in the last 30 days) and your answer to the optional question “How did you hear about us?”, for as long as the booking or enquiry itself. Detailed events (with the visit and visitor IDs) are kept for 90 days, after which only daily totals remain (without any ID), kept for two years.

Your rights

You have the right to access your data, to rectify, erase or restrict its processing, to data portability, and to object to processing based on our legitimate interest.

A request sent to info@carngo.eu is enough. We answer within a month. If you believe we process data unlawfully, you may complain to the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

Transfers outside the European Economic Area

We do not ourselves transfer data outside the European Economic Area. The exception is statistics from Google Analytics 4, collected with your consent, which Google may process in the United States as described in the “Google Analytics 4” section.

Providing your data

Providing data is voluntary, but without an e-mail address or a phone number we cannot answer an enquiry, and without the document details we cannot conclude a rental contract.

Changes to this policy

We update the policy when the way the site works changes. The date of the last change is at the bottom of this page.